Research demo
MCP servers and hosts store long-term third-party API keys in plaintext, world-readable files
AIR-2025-0031 AIR record · 2025-04-trailofbits-mcp-plaintext-credentials
From the supporting source
On macOS, we found this file has world-readable permissions: `-rw-r--r--` permission set allows any process or user on the system to read the file's contents.blog.trailofbits.com
The record
Disclosed
2025-04-30
Vendor
multiple
Product
Official GitLab, Postgres and Google Maps MCP servers; Figma connector; Superargs; Claude Desktop, Cursor, Windsurf
Risk domain
Access control and permissions › Credential theft
System type
Generative model
Who acted
AI was the target — world-readable plaintext key storage in MCP hosts
Attack surface
MCP server
Autonomy level
Copilot with approval
Initial vector
Local file permissions
Impact type
Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Any machine running MCP hosts with default config file permissions
Capability abused
Taxonomy & references
Curator notes
Author Keith Hoodlet. Fourth post in the MCP series.
Cite as
Enkrypt AI. "MCP servers and hosts store long-term third-party API keys in plaintext, world-readable files". AIR, AIR-2025-0031. https://agentincident.vercel.app/i/AIR-2025-0031/ (accessed 2026-10-19).